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Device and metiiod for checking railway logical software 
engines for commanding plants, particularly station 
plants. 



The invention relates to a device for checking 
logical software engines for commanding railway plants, 
particularly station plants, conprising at least a 
conputer with at least: a central processing unit and at 

10 least a memory for loading and executing programs : 

a logical engine for commanding a plant, 
particularly a station plant, being loaded or loadable 
in said memory for its execution, which plant comprises 
a plurality of operating units for actuating and/or 

15 detection and/or measurement and/or signalling, so- 
called wayside equipments, which units are provided for 
receiving command signals and for transmitting control 
signals about the operating condition, and which 
logical software engine reads control signals given by 

20 the operating units for actuating and/or detection 
and/or measurement and/or signalling and it processes 
command signals of said operating units basing on an 
operation protocol of the plant itself. 



25 occurs by means of command logical engines which are 
based on Boolean algorithms. Control and cozomand 
signals are univocally associated to state variables 
which are processed by Boolean logic that provides 
output command signals as modifications of said Boolean 

30 variables. Depending on the features of provided 
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In railway field, the command of station plants 
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operating units, each of the said variables may liave 
various state conditions and the associated variables 
representing the state controls and the state 
coinmatation commands of operating units may vary within 
5 predetermined values, each of the said values 
represents an operating condition of the operating unit 
as far as variables representing control signals are 
concerned, while the said values represent a 
commutation command from a predeteannined operating 
10 condition to a different predetermined operating 
condition or a command for maintaining the operating 
condition as far as command signals are concerned. 

Starting from a traditional realization of cramand 
and control logics, particularly of railway plants, in 
15 the shape of relay networks, at present the greater 
reliability and stability, as well as the greater 
comfort and flexibility in using computers, have caused 
the transfer of command functions from the relay 
hardware staructure to a software command system 
20 emulating the behaviour of the traditional relay 
network by means of a command and control logical 
program con^osed of Boolean algorithms. 

Because of the complexity of railway plants, even 
the logic for controlling and coxmoanding the plant is 
25 relatively complex specially considering that in 
railway field the security operation standards are very 
high. 

In order to transform the control and command 
hardware logic formed by relay networks into a program 
30 in the form of a control and command Boolean engine. 
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hardware/ software smart syat^is have been developed to 
process automatically the control and command Boolean 
program by starting from a traditional relay hardware 
network layout or from a table wherein the operation 
5 conditions of the plant are encoded in the shape of 
lists of state variables and state comraatation 
variables, the so-called condition table. 

At present the validation, i.e. tests, are 
directly made on the plant. However, this is a serious 
10 draiAack firstly because an operating plant is actually 
required to which the control and command logic has to 
be applied. This causes great problems due to great 
prolongation of time for definitive installing a 
railway plant, since in addition to time for actual 
15 structural installation, such as line laying, and the 
hardware installation of aerating units, it is 
necessary to make long validation phases of the command 
logic thereof. 

To solve this problem, at least partially, 
20 software programs for validating command software 
logics have been provided, i.e. Boolean engines for 
controlling and commanding the station plants, that 
process individually and in parallel the same command 
and control logical engine by means of at least two 
25 generation programs of the control and command logical 
engine, starting from the same basic information about 
the system structure and the operation modes thereof. 
Two command and control logical engines are therefore 
generated and are therefore compared, whereas the 
30 validation is based on diversity criterions of the 
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programs generaUng the two logical engines which are 
considered correct In case of functional Identity 
basing on said diversity of the two generating 
programs . 

5 Such validation or certification mode does not 

meet fully considerations thai: are made from the 
security perspective of the plant operation and so the 
control and command logical program tha^ has been 
obtained Is always subjected to a deep validation 

10 dlrecU.y on the plant. The certification or validation 
mode by means of the diversity criterion of the 
software generating the command and control logical 
program lacks an Interface with the plant. 

Therefore, even In this case of software 

15 certification and validation, such defect Influences 
again the time for fabricating the plant; In operation 
condition and the time for developing and setting 
both the control and command logic and the plant 
Itself. The situation becomes more serious considering 

20 not only the Installation of a new plant, bul: also the 
modification of an existing plant. In such case 
certifications and validations made on field Influence 
railway traffic that pass anyway and must continue to 
pass on railway lines already existing. Therefore times 

25 are smaller and working conditions are more critical 
both for the difficulty In working on a plant In use 
and for the considerations about traffic security that 
cannot be Interrupted except for short periods. 

Therefore, the purpose of the Invention Is to 

30 provide a device as described hereinbefore that allows 
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to overcosne the dra^aeks existing at present and 
described above. 

The invention attains the above purposes by neans 
of a device as described hereinbefore, wherein a 
5 software simulation program of the plant is loaded or 
loadable in the coxnputer memory and is executable by 
the computer itself, which simulation program must be 
controlled and commanded by the control and command 
logical program and which simulation program faithfully 

10 reproduces the plant structure and the operating modes 
of operating units provided into said plant. 

The simulation of the plant structure and of the 
operating units associated thereto, such as track 
circuits to detect the presence of the train, switch 

15 points actuators, signalling actuators and other 
different units is represented in the simulation 
program by Boolean algorithms, variables associated to 
said algorithms being univocally defined to represent 
control signals of the several state or operation 

20 conditions of various operating units and the command 
signals for commutating or maintaining state or 
operating conditions of said various operating units. 

In a first eaobodiment the image of the plant 
behaviour under examination of the control and command 

25 logical program is displayed in the shape of variable 
lists univocally associated to the several operating 
units. In such case, the program displays or allows to 
display report files wherein the several operating 
units and the associated state or command variables are 

30 listed. 
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Advantageously, tbe sinalation program allows the 
user to set starting aerating conditions o£ the plant 
and/or setting situations even anomalous of the plant 
operating units to verify the plant reaction to these. 

5 conditions . 

According to a preferred enibodiment, to each plant 
operating unit and/or to each relevant structural 
element can be associated univocally a virtual image of 
the operating unit and/or of plant structural element, 
10 which image is generated by means of a graphic program 
loaded, loadable and/or eKecutable by the computer of 
the device according to the invention. The virtual 
image is univocally correlated to the logical program 
for generating the operating unit or the plant 

15 structural element, the graphic program for generating 
the virtual image of each operating unit being such to 
generate various graphic aspect conditions of the 
operating unit, each of them is univocally correlated 
to a predetermined value of variables relevant to the 

20 operating condition of the operating unit itself and/or 
of command variables for commuting or maintaining the 
operating state of the operating unit. 

According to a further aspect of the invention, 
the operation of the control and command logical 

25 program is additionally in parallel or alternatively 
represented in the shape of behaviour of the equivalent 
command hardware logic cooposed of a relay network, an 
operation simulation program of relays and an operation 
simulation program of the relay network being provided, 

30 as well as graphic programs representing relays 
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unlvocally aasocxated each program for simula'ting 

relays and ^o program £or graphically displaying the 
relay network. 

Also In this case, as In the case of operating 
5 units, each relay Is simulated by meains of a logical 
program of the Boolean type, single state conditions of 
the relay and/or the commutation commands being 
represented by state or command variables and graphic 
programs being such to associate various relay graphic 

10 aspects imlvocally correlated to values taken by said 
state or command variables . 

By means of what said before, the device according 
to the Invention allows to execute the validation or 
the certification of the control and cozmnand logical 

15 program of the system on the base of a true and 
reliable software model of the real plant with evident 
advantages In relation to certification and validation 
systems used at present. 

The two levels for displaying the functional 

20 behaviour of the plant. In the shape of report file 
displaying values of state variables generated by 
programs processed by simulation logical programs of 
operating units and In the shape of graphic 
representation of the operating condition of operating 

25 units allow to check In details the operating units of 
the plant and therefore the operation modes thereof 
both In an analytic way and In a direct visual way of 
the physical operation condition. 

A further alternative allowing the display of the 

30 command and control logical engine In the shape of 
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traditional relay networlc allows to check tbe engine 
operation according to the traditional hardware logic 
providing an additional visual check means. However, 
also in this case it is possible to display physically 

5 the aspect modifications of relays relevant to the 
operating condition, as well as to display analytically 
the state and command variables analogously to what 
said for the operating units. It will be noted that the 
graphic representation of the Boolean command and 

10 control logic, in the shape of traditional relay 
network, allows to check visually the internal 
operation of said logic, therefore making simpler the 
identification of errors inside the logic itself and 
not only on the base of wrong commands sent to 

15 operating units. Therefore it is displayed not only the 
situation of ou^ut variables and input variables to 
the control and command logic engine, but also the 
situation of modifications to which said variables are 
subjected during the processing from input to ou^ut. 

20 Additionally, the provision of an interface for 

setting particular operating conditions of the plant or 
an<Maalous conditions allows to check the plant 
reactions with reference to different operating 
environment. Such settings can be executed by the 

25 personnel by ixiposing specific state conditions to 
various operating units at the beginning of the 
execution cycle of the control and command logical 
engine, being possible, by means of a suitable 
scheduling, to provide also conditions wherein one or 

30 more operating units are non-operating or operating in 
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a anoxaalous way. 

It Is easy to notice that In the case of the 
present Invention xt Is possible to program or 
configure images and/or state and command variable 
5 lists of virtual operating units corresponding to the 
desired or proper operation or state condition of the 
plant in conjunction with a predetermined operation 
situation. In such case, by providing such nominal 
graphic images and sucdi nominal values of state and 

10 c^nmand variables of virtual operating units it is 
possible to make not only the direct and visual 
verification of a proper operation but also an 
automatic verification based on the comparison between 
the nominal image and the table or the nominal list of 

15 state and command variables desired and previously 
scheduled and the ixiiage and the state and command 
variables effectively processed in the mraaent of 
operation of the control and command logic with the 
virtual model of railway plant, an error message being 

20 sent in case of non-identity. During this aut^natic 
verification can be displayed graphically and 
analytically the operating unit that assumed a wrong 
condition and the relative state or command 
variable/variables • 

25 Such mode can be extended also to the simulating 

representation of relay network, indicating the relay 
or relays that have not been comonitated in the right 
condition and the relative state or commutation cOTmand 
variables • 

30 As a further development it is also possible to 
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provide autonaUc means that correct the control and 
command logical program on the base of possible 
corrections made by the user to the state or c omm a n d 
variables modified manually in the presence of a state 
5 or command error of a virtual operating unit or of a 
relay in the corresponding command logical circuit 
constituted of the virtual model of relay network. 

In this case, modification interventions both of 
alphanumeric type made on report files of state or 

10 command variables/ or interventions for modifying 
graphically the aspect of the operating unit or relay 
corresponding to the state of said operating unit or 
said relay are interpreted by a correction program that 
analyse the values of state or command variables set 

15 manually to correct wrong values, analyse the control 
and command logical program and modify the code to 
commute the operating unit or the relay in the correct 
state condition when occurs the operation condition 
with which the control and command logical program had 

20 previously generated the error. 

It is also possible to memorize areas of the 
virtual station plant and the relative parts of the 
control and command logical program having typical 
plant structures that are recurrent in various station 

25 plants, to load and reuse both programs of Boolean 
simulation, and graphic display programs as well as 
parts of control and command logical programs in new 
station plants having identical station areas. 

The hardware/software structure of the device 

30 according to the invention allows to extend the 
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validation and the certification even to a validation 
and certification system based on the diversity of the 
program for generating the control and command logical 
program, for exanple a so-called Boolean algorithm 
5 checker. 

It is possible to provide several possibilities. A 
first of these possibilities is to provide an 
additional program for generating the control and 
command logical program object of validation by the 

10 device that works according to a code different than 
that used for generating the control and command 
logical program during the validation. The control and 
command logical program generated by the checker may be 
compared with the control and command logical program 

15 during the validation to notice the identity between 
the two control and command logical programs. In 
addition or alternatively the control and command 
logical program generated by the checker may be 
subjected to the certification or validation by means 

20 of the device described above and the results may be 
cdopared to those obtained during the validation or 
certification of the first control and command logical 
program. In this case the comparison verification is 
made on state and command variables of operating units 

25 and relays of the relay virtual network both from a 
numeric perspective and from a graphic perspective. For 
example a overlapping of graphic images of the plant 
state conditions may be supposed which are obtained 
with the two control and command logical programs. With 

30 this overlapping of the image of plant state condition 
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the possible differences are graphically highlighted or 
catch dlrecUy the user eye. 

The two modes described above may be made 
alternatively or successively one with respect to the 
5 other, the modification of the succession sequence of 
the two different comparison modes being also possible. 

By making first the comparison relevant to the 
plant conditions obtained by the two control and 
coxmaand logical programs It Is possible for example to 

10 Ideatlfy better the parts of the program wherein the 
conparlson operations and so the possible correction 
operations thereof or the debugging enquires (error 
detection) may be limited. 

It Is possible to make the certification based on 

15 diversity In addition to the control logical program 
even to the logical programs for simulating the single 
operating units and the plant structure as well as to 
logical programs for simulating relays or the relay 
network and In case this certification action based on 

20 the diversity of the generating program may be extended 
also to programs for graphically representing operating 
units or relays. 

Xn a further embodiment, the Boolean checker Is 
composed of a parallel device for verifying the control 

25 and command logical program of the railway plant by 
simulating the plant Itself, which checker comprises a 
check or test program and the simulation programs of 
the railway plant developed according to diversity 
crlterlons. I.e. by other generating or writing 

30 programis and such checker makes the same certification 
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Of the device according to the Invention, that Is the 
£lrst checker device, on the same control and command 
logical program, the results of the two parallel tests 
being compared and from this comparison Information or 
5 error messages are generated depending on the result of 
the test If It Is equal or If It has diversities. 

In the field of the device according to the 
Invention a design program Is Included, I.e. for 
generating the Boolean code and the program for 

10 graphically representing the wayside eqpilpxnents • 

While the device of the present Invention Is based 
on traditional or substantially traditional processing 
systems. It should be noticed that actually It Is a 
technical device constituting substantially a virtual 

15 simulator of the real plant structure and so It has 
advantages and technical effects. 

The choice of software means Is based on the fact 
that the command logic Is a software too, whereby the 
Implementation by means of a software means Is the best 

20 solution • 

It should be noticed also that the device 
according to the present Invention may be provided with 
a suitable network Interface and It may become a non- 
vital node of the. railway plant by means of which It Is 

25 possible to modify easily the command and control 
logical program and to overcome virtually the same, for 
example In the case of a structural modification of the 
station railway plant, such as the removal of a line or 
the addition of a line with the corresponding operating 

30 units . 
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Moreover tlie device according to the Invention as 
a node network connected and Interfaced with the 
railway plant may have supervisory or diagnostic 
functions of the correct operation of the real railway 
5 plant, because It Is easy to make a comparison between 
the state condition that has been assumed by the real 
plant and the one assumed by the simulated plant by 
providing the device with the same Input variables of 
the real plant for the control and command logic. Such 
10 comparison may be made analogously to the conqparlson of 
the plant conditions obtained with the two control and 
command programs as described before for the additional 
validation or certification based on diversity 
crlterlons . 

15 By means of the device according to the Invention, 

since It Is a node that Is part of a control and 
command system of a station plant. It Is possible for 
exanple. In emergency event, to simulate various 
possibilities for Intervening and commanding the plant 

20 to realize, on the plant Itself, the choice that offers 
the best solution among the possible choices. 

Advantageously the device according to the 
Invention comprise a program for executing the 
simulating functions with a user Interface of the type 

25 used by Windows 0 program of Microsoft Inc. and that 
therefore conqprlses operating windows with function 
buttons, quick choice menus and other functionalities 
typical of said Interface, In addition obviously to the 
use of mouse or of other pointing nbeans, to selection 

30 and input of commands and the keyboard to Input 
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numerical, alphanumerical data and/ or numerical or 
alpbsinumerlcal commands, sucli as to create and modify 
the graphic Images of operating units and/or of relays 
or of other parts of the plant structure- This makes 
5 the actions very single and easy for the employed 
personnel by creating an Interface between the cc^oputer 
and the program and the user that Is very known and of 
large exiployment« 

Further features and Improvements of the device 
10 according to the Invention are subject matter of the 
dependent dalxas* 

The features of the Invention and the advantages 
derived therefrom will appear more clearly from the 
following detailed description of some exobodlments by 
15 way of a non-limiting example Illustrated In the 
annexed drawings. In which: 

Fig. 1 schematically shows a device according to 
the Invention In the shape of a computer or a personal 
conputer and the possible remote connections . 
20 Fig. 2 shows a flux diagram of the functional test 

made by the device according to the Invention. 

Fig. 3 shows a schematic diagram of the Internal 
functions of the device according to the Invention. 

Fig. 4 shows an example of a display window of the 
25 system graphic layout, particularly of the station or 
the station region simulated by the device during test 
function of a command and control logical program of a 
railway system. 

Fig. 5 shows two details of toolbars and 
30 Instruments of starting windows for carrying out the 
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verification by means of the device according to the 
invention . 

Fig. 6 shows an exaxople of windows that are 
displayed when the con^lete simulating and test program 
5 is loaded and wherein a control window is ^>ened for 
the dev^l equipment* 

Fig. 7 shows an example of a window for the add 
and modify selection of simulating programs of system 
Iterating units, particularly wayside equipment. 
10 Fig. 8 shows an example of a window for the 

interface specification of each operating unit or 
equipment simulator defined by fig. 7 window. 

Fig. 9 shows an example of a window for €»:ecuting 
the specification function of the behaviour of the 
15 operating unit or of the equipment in relation with the 
virtual model coaoposed of the Boolean sixmilator that 
describes it. 

Fig. 10 shows a table for describing values that 
can be assumed by variables in truth table and the 
20 above table. 

Fig. 11 and fig. 12 show dr^ down menus that can 
be activated by the specification window of the 
behaviour of the operating unit or of wayside equipment 
according to £ig* 10 to execute particular 
25 specification functions of said behaviour. 

Fig. 13 shows an example of a window for selecting 
graphic aggregates. 

Fig. 14 and 15 show additional windows to execute 
functions for modifying or adding graphic aggregates 
30 accessible by buttons of the window for selecting 
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graphic aggregates according to flgiire 13. 

Fig. 16 allows an example of a window to execute 
the state and colours specification of graphic objects. 

Fig. 17 shows a window for selecting and loading a 
5 ^^Condltlon Table''. 

Fig. 18 shows a structure table of a "^^Condltlon 
Table'' file. 

Fig. 19 shows an exaxnple of "^Condition table" 

file. 

10 Fig. 20 shows an example of "^Simulation Commands" 

window. 

Fig. 21 shows an exasple of a window for managing 
simulation commands accessible by quick button or menu 
command In the window according to figure 20. 
15 Fig. 22 shows an example of a window for selecting 

the variable value accessible In the window according 
to fig. 20 by quick button or menu command. 

Fig. 23 shows a window for displaying Boolean 
equations of the control and command program. 
20 Fig. 24 shows a window for displaying the 

equivalent circuit of a Boolean equation of the Boolean 
equation system co9q>oslng the control and command 
program during the test step. 

Fig. 25 shows an example of a window for 
25 displaying the circuit of a simulated equipment. 

The annexed pages Al, A2, A3, A4 show an example 
of a test according to the tool for executing automatic 
test and Include the report file of said test. 

Referring to figure 1, the device according to the 
30 Invention consists of a function simulator of one or 
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more systems tliat are composed of a station apparatus 
wxtli a vital computer with regard to test of tlie 
conmand and control application logical program which 
is inplexoented as a group of Boolean equations. The 
5 device is formed as to simulate a station apparatus 
with a vital computer in all its operating conditions. 

In traditional systems for commanding and 
controlling railway plants, the application logic for 
operating the system is in the shape of a relay 

10 netupork. Lately, with introduction of computers more 
and more reliable and steady, application logic of the 
plant has been replaced by a command and control 
logical program which is executed by a computer. The 
program is comprised of a group of Boolean equations 

15 that cyclically read the state conditions of a 
plurality of operating units, the so-called wayside 
equipments , such as track circuits for detecting the 
presence of trains at predetermined line lockings, 
signalling devices, switch points, etc., and basing on 

20 said conditions, coded in the shape of state variables, 
the Boolean equations compute or define new ou-^ut 
state variables that constitute commands for commuting 
the state or for maintaining the operating state of 
operating units for the adjustment to conditions 

25 represented by the input variables. 

The group of Boolean equations has to execute the 
computation of the state conditions of wayside 
equipments in a way corresponding to predetermined 
operation modes that are coded in functional behaviour 

30 tables of the plant, so-called condition tables. The 
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device according to the present Invention has to 
emulate the functional behaviour of a railway plant, 
that Is a vital computer railway apparatus. Such 
emulation allows to verify the control and command 
5 logical program expressed by the formalism of the 
Boolean equation system as If the verification Is 
executed on the real plant Itself. And this occurs both 
when the plant Is In correctly operating conditions and 
when there are anomalies of one or more wayside 

10 equlpnent . 

The device according to the present invention as 
shown In figure 2 Includes a computer mexnorlzlng a test 
and simulation program and has Interfaces to data 
and/or commands inputting means, display means, 

15 connecting means to remote apparatus, such as the 
station apparatus with vital computer, remote cwnputers 
for executing collateral procedures and so on. The 
emulation program Includes several routines and in 
particular : 

20 a routine to execute the Boolean equations that 

coxDposed the program Itself; 

a routine to configurate input or initialization 
variables of Boolean equation system, that is the 
setting of aeration backgrounds of the plant; 

25 a routine to display the graphic image of the 

plant and of operating units Included therein and which 
provide an image of operating units that is different 
for each of the c^erating states that can be assumed by 
the cqperating units or wayside equipment and which 

30 graphic image is univocally connected to said state or 
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said opera'txng condition of the wayside equipment, as 
well as to other collateral routines that conplete and 
sisplify test actions. 

The plant simulation occurs by generating a 
5 virtual model of station plant wherein the operating 
and/or structural elements of the plant are univocally 
identified and whose functional behaviour is restored 
by Boolean equations. 

The physical structure of the system is defined by 

10 associations of said structural or operating units that 
describe and/or display the respective arrangement in 
the plant diagram and define which operating units have 
to work together. 

As it will be noticed more clearly below, the 

15 operating units, i.e. wayside equipments, are described 
by output state variables so-called control and that 
describe the operating condition of the unit or wayside 
equipment and by variables for maintaining and/or 
modifying the input state that indicate if the 

20 operating unit has to change state or not and towards 
which state the transition has to occur. 

To generate the virtual model of the railway 
plant, the device according to the present invention 
provides not only the simulation of the functional 

25 behaviour of wayside equipments in the shape of logical 
program in the form of Boolean equations, but also the 
graphic representation of the wayside equipment. Such 
graphic representation conprises several predetermined 
graphic aspect options of the wayside equipment, each 

30 of them corresponds univocally to an operating state 
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thereof and Is associated to one of the predetexxnlned 
values that are assumed by the state variables of the 
simulation logical program of the wayside equipment or 
to a predetermined value combination of two or more 
5 state variables provided by the simulation logical 
program of wayside equipment. Obviously, the graphic 
aspects of the wayside equipment will be schematic 
reproductions of the wayside equipment aspect and the 
several aspects corresponding to the several operating 

10 conditions of each equipment are different one from the 
other so as to reproduce as much as possible the real 
modifications of the aspect of wayside equipment In 
various operating conditions . 

Advantageously the device according to the 

15 Invention may also comprise tools for modifying and/or 
generating simulation logical programs of wayside 
equipments and/or of the graphic aspect for 
representing said equipments In various operating 
conditions. These can be memorized and then recalled as 

20 generic routines that assume a specific and unique role 
In a predetermined plant diagram by means of defining 
unlvocal Identification names and unlvocal relations or 
functional associations with other wayside equipments 
or other structural elements of the plant as well as 

25 with corresponding arrstngement relations In the space 
regarding the placing thereof In the graphic 
representation of the plant. 

Obviously, as results from figure 1 the plant can 
operate also In direct combination with units 

30 generating the control and command logical program 
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and/or wltlx tlie real vital computer station apparatus 
and the real railway plant, being a non- vital node of a 
connection network with said units. 

Therefore, referring to figure 3, the device 
5 substantially Is a workstation based on a personal 
conputer. Advantageously the preferred operating 
environment Is Windows NT ® envlroniuent upon which the 
specific device simulating software Is set up. Said 
choice of the operating environment Is an advantage as 

10 Windows KT ® environment and Its basic functionalities 
are broadly known. Therefore the operating environment 
Is structured as to display several work windows, 
conqprlslng the station or plant diagram, while the user 
Is working on configuration and/or control elements of 

15 the simulation device Itself. By means of one monitor 
and preferably two monitors the user can see directly 
the selected functions or set actions, as the main 
simulation logical program and the graphic management 
program Interact therebetween. 

20 The auxiliary display is controlled by the desktop 

extension functions already provided In Windows 0 
environment . 

The software of the device Is made as a typical 
Windows ® application and therefore It employs typical 
25 tools of the operating environment. Here the specific 
sphere of all the possibilities and of the window 
structure of Windows ® Is not considered since this Is 
part of a basic common and widespread knowledge. 



30 with the device according to the Invention It Is 



To execute the checking by xneans of simulation 
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necessary to make several storting activities 
conprlslng the following steps: 

generating the graphic descriptive file for check 
means; 

5 checking said graphic file; 

generating Boolean equations whose system Is the 
core of the control and command logical program; 
possible generating of the conversion table; 
possible generating of the coded condition table; 
10 possible generating of text files so-called batch 

commands • 

The checking activity of the cramand logical 
program uses check means that are generally known. 

The check program by means of railway plant 
15 simulation comprises the following data: 

File with Boolean equations that describe a 
station or an area to be checked; 

Graphic files of the station or station or area o 
areas to be simulated; 
20 Possible files containing the conversion table; 

Possible files containing condition table 
and possible text files containing batch files. 
Us the result of test is provided an output report 
file that can be used by the user and/or memorized. 
25 During the test execution, the dynamic operation of the 
railway plant may be controlled both real-time and in 
case later and this by means of the display of 
alphanumeric messages or of state variable values and 
by means of the graphic representation of the plant 
30 itself. 



wo 2004/044788 PCT/EP2003/050724 

24 



The starting of the working session may comprise 
the generation of a new project or the loading of 
projects already started. If It Is a new project one or 
more stations or plant areas have to be selected to use 
5 In the simulation. 

After the loading and/or the generation of the 
project data It Is necessary to provide the device 
configuration. The activities to be executed to make 
the test by means of railway plcoit simulation are: 

10 setting of a system cycle time; definition of suffixes 
for each kind of wayside equipment, definition of 
simulators of wayside equipments, the possible addition 
of area to be controlled, association of equipment 
simulators to variables; definition of colours and 

15 states that the drawing objects can assume, assignment 
of stats and colours to the drawing objects. 

As already said, there Is also a command that 
operates directly on the graphic diagram of the station 
or of the plant area to define equipment states and 

20 objects colours. 

It Is possible to activate control windows by 
selecting windows or objects to be Inserted In windows 
and/or to activate the command bar If It Is not already 
active. Obviously It Is possible to make tests and save 

25 the current state of the project. To this end. It Is 
convenient to make savings as the simulation situation 
evolves, saving always with different names to not 
overwrite the old configuration. Each configuration Is 
re-loadable to start a new simulating step. During the 

30 simulation It Is possible to execute configuration 
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batch files corresponding for instance to different 
operation or configuration background of the plant or 
to different ccsnmands. 

The device can be conqpletely managed by a rexoote 
5 workstation by tneans of a comsiand and remote connection 
module, particularly by means of network protocol and 
more preferably by means of TCP/IP protocol. 

The user may end the check process by simulation 
at any time without loosing the work already carried 
10 out, by saving the project. Project means all files 
generated before the test process and all files 
generated during the configuration and simulation steps 
thereof • 

Figure 4 shows an example of a screen showing what 
15 appears on a monitor during a test execution. 

The first screen that appears by starting the 
system is substantially similar to that of figure 5. A 
window wherein the top 10 allows to manage the 
application is opened, whereas the window 11 is the 
20 command bar for the simulation. This second window can 
be shifted by highlighting the top band and dragging it 
in a location useful for the user. 

Directly below the main command line 110 (file. 
Views, etc.) a quick button bar is displajfed to 
25 activate quickly some commands. 

The meaning of buttons will be disclosed in 
sections that deal with the command itself. 

Moreover a help command or button is provided 
which activates a help menu by which it is possible to 
30 enter or consult a guide file. The guide can be of 
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interactive type or on line analogously to Windows ® 
environment. Analogously to this environment once 
activated the command, a window of the guide appears 
from which it is possible to select display, printing 
5 options and so on. 

File command in the command bar 110 allows to 
start a new project or to open an existing one, to save 
the current project and to save the current project and 
exit the application. The command options of file 
10 command are accessible by means of a typical dr^-down 
menu which lists all the command options and it is 
possible to select the desired command therefrom. 

Some or all the commands can be personalized and 
transformed by creating a routine in any kind of quick 
15 activation buttons. 

Quick button 210 allows to start a new project, in 
order to define the whole background of a simulation, 
that is to define the stations to be examined, control 
windows which are desired to be activated, variables to 
20 be displayed, display modes, as for example the window 
aspect , colours , intermitting colours , displays with 
numerical wave -forms or of other kind. 

If a project is already loaded in the device, the 
user is asked to save or eliminate the project by a 
25 communication window having command buttons for 
executing the above several options. 

In order to save a loaded project it is possible 
to use the corresponding command of ^^file" menu or to 
use the save quick button indicated at 410. 
30 When loading, the program controls syntax and 
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semantJics o£ conf iguratxon files and o£ graphic drawing 
£lle of the plant, of the areas thereof and of wayside 
equipments. Moreover, the simulator modules are 
Identified, I.e. simulation programs of operating 
5 units. I.e. of wayside equipments and graphic display 
modes of wayside equipments or operating unit states, 
such as colours of graphic objects of the drawing. fThen 
said files include an Irreparable error, the device 
does not load the file that has errors . Errors are 

10 listed In a summary box of a window displayed for each 
plant, station or plant area. 

The finishing function Is ended when the operator 
sends a confirmation and the result of loading Is the 
opening of two windows 10 and 30 as shown In figure 6. 

15 In addition to the main window 10, Is generally 
displayed even the control window 30 and the graphic 
layout of the plant or of the station or of the loaded 
area. 

The loading of a project provides displaying of 

20 following data: 

Name of the plant or of the station or of the 
area, number of variables which are Included In 
equations describing the plant or the station or the 
area, number of Pterm, I.e. product terms obtained In 

25 the Boolean equations, of the plant, or of the station 
or of the area, the variable covering. I.e. the 
percentage of variables processed with the proceeding 
of the simulation and the covering of Pterm, I.e. the 
percentage that has been processed with the proceeding 

30 of the simulation. 
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The quick button 510 provides the closing function 
of a project. Project management menu that is 
accessible from the command bar 110 of window 10 makes 
available two commands that are Add Station/Area and 
5 Cancel Station/Area commands. To these commands quick 
command buttons are associated which are indicated at 
610 and 710 in the quick button bar. 

Add Station/Area command or the corresponding 
quick button 610 allows to add a new station or a new 
10 area to the project that is already loaded in the 
memory. 

A dialogue window is displasfed for specifying the 
Station/Area. The user can specify filenames belonging 
to the station or to the area that the user must type 

15 in a field of the dialog window. Instead of typing the 
name/ the user can use a searching means which is 
accessible by means of a searching button. In this case 
a window is opened wherein saved stations or areas are 
displayed. With pointing means, the user can select and 

20 load the desired stations or areas among these in the 
list. It is also possible to select the format of 
graphic files that contain the station or area graphic 
drawing for example a CAD or T6IF file type. 

By the "^^layouf button the user can specify the 

25 particular files constituting the station or area 
graphic drawing. Depending on the drawing format, a 
dialog window is opened to specify the corresponding 
station or area. In the predetermined field the user 
can indicate the drawing filename for example in CAD 

30 format. An auaciliary CAD file field allows to specify a 
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file containing further graphical syaibols to be 
naturally joined with the CAD drawing. When the 
selection ends, the program loads the station or zone 
configuration file and the station or zone drawing 
5 files. During the loading, files are syntaxly and 
semantlcally controlled. If files have Irreparable 
errors, the system does not load files containing 
errors. The program lists errors In a summary box. If a 
serious error occurs In the configuration definition 
10 file, the station or the area will not be made in the 
memory. Xf the loading Is properly ended, the station 
or the area is made in the memory and the graphic 
drawing appears on the screen. 

It Is possible to €»cecute the action of 
15 eliminating a station or an area from the project by 
means of Cancel Station or Area command or by means of 
the corresponding quick button 710. 

The command bar 110 provides the additional 
^^configure^' command. This command provides the 
20 possibility of choosing between several captions in a 
menu. A first option is the cycle time definition 
command. Even for this command a quick button is 
provided indicated at 810 in figures 5 and 6. 

The logical program for controlling and commanding 
25 a railway plant, particularly a vital control station 
apparatus, executes the reading of control signals 
provided by wayside equipments and the sending of 
command signals according to a cyclic operation. 
Typically the whole transmission and processing reading 
30 cycle is executed in about 500 xas. In each cycle the 



wo 2004/044788 PCT/EP2003/050724 

30 



Boolean equat:lon8 wlixcb formed tbe control and command 
logical program are recalcnlated. In the program of the 
device according to the Invention, the user can set any 
cycle time corresponding to a real number. To this end, 
5 the quick button 810 or the menu command cause the 
opening of a window for setting the cycle time wherein 
It Is possible to specify a cycle time. 

The ^^Configuratlon-M6dlflcatlon suffixes'^ command, 
allows to detearmlne the suffixes. It Is an Important 
10 action since suffixes determine the behaviour and the 
semantic meaning of Boolean variables In the system 
configuration file, that Is equation file. A wrong 
suffix definition may cause an Irreparable error during 
the processing of the system definition file and this 
15 error disables the management of corresponding stations 
or areas or wayside equipments. I.e. of operating 
units « Suffixes have to be defined In compliance with 
similar definitions Included In the system definition 
file, that la in the data file frcwa which system EPBOM 
20 memories are programmed. Settings of suffixes are 
executed with the help of a dialog window. 

It is possible to use a box for modifying the 
suffix to specify suffix name. The name can Include 
block letters. A Type'' drop down menu comprises all 
25 possible types that are available and selectable. 
Suffix meanings are: 

Input: It is possible to use variables of input" 
type only on the right (element of a product term) of a 
Boolean equation into the system configuration file. 
30 When reference is made to a variable of input'' type on 
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the left of a Boolean equatu.on, as a result tlie program 
points out an error during tlie system definition file 
loading . 

Output: Variables of ^^out^ut"^ ^ype have to be used 
5 on tbe left of a Boolean equation only once. When 
reference Is made to a variable of ^^ou^ut^' type on the 
right of a Boolean equation or more than once on the 
left thereof, the program points out an error during 
the system configuration file loading. 

10 Current cycle: It Is possible to use variables of 

^^current cycle'' '^yp^ on both sides of a Boolean 
ecpiatlon. A reference to the variable Is possible only 
once on the left and so many times as desired on the 
right of equations which are successively calculated In 

15 the same cycle. If the use of a variable of "^"current 
cycle'' type does not comply with the above norms, the 
program points out an error. 

^^Subsequent cycle" : It Is possible referring to 
variables of subsequent cycle" type on both sides of a 

20 Boolean equation. These variables may be placed on the 
right of an equation (term) at any time. If a reference 
has been made to such variable on the left of an 
eqpiatlon (result) It la not more possible to use It on 
the right I.e. In equations executed In the same 

25 processing cycle but calculated successively. 

Shared Input: shared Input" variable type Is 
similar to ^^Input" type having the only difference that 
the program updates these Input values by using 
suitable shared outputs" of other areas or other 

30 equipments after each calculating cycle. 
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Shared output: "^sliared output'' type Is similar to 
"^output'' type having the only difference that the 
program employs values o£ these outqputs to i^date 
suitable "^shared inputs'^ of other areas or other 
5 equipments after each calculating cycle. 

Timed: '^timed'^ type is similar to current c^cle'' 
type. The difference is that the variable associated to 
timed" type will be true if the equation calculating 
it is true and the delay time that is specified for the 

10 variable is expired, starting to count when the 
starting equation becomes true. If the variable 
associated to the timer has been previously calculated 
as true and the equation associated thereto is now 
calculated as false , the value of the timed variable 

15 will go immediately to false without any delay. An 
equation used to calculate a variable of timed'' type 
must be preceded by the definition of a delay, as 
indicated before with reference to the ccmimand for 
setting the system cycle time. The program point out an 

20 error if a delay for an equation of a non ^^Timed'^ type 
has been specified or if an equation of "^Timed'' type is 
not preceded by a delay specification. 

Blinking Output FLS: this type of variable is 
equivalent to the ^^Ou^uf type. The equation that 

25 calculates the value of a variable of ""Blinking Output 
FLS'^ type xmast be preceded by an equation calculating 
the value of a variable defined as '^Output'^'. If 
equations do not meet this condition, the program point 
out an error. 

30 The command bar comprises an additional command 
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called ^^Conflgure-Add equipment simulator'^. Analogously 
to otber commands y also tbls command can be activated 
by a quick button Indicated at 910 In figures. By this 
CCTmiand It Is possible to define a physical equipment 
5 or operating unit slnnslator. The definition of physical 
and logical equipment simulators consists In defining a 
model that Is made In three steps: 

defining a name for the new simulator; 
Interface specification; 

10 designing the behaviour; 

A window Is activated an example of which Is shown 
In figure 7, The window allows the selection of 
simulator name. The name may be typed In a suitable box 
of the window. An add button allows the addition of the 

15 specified name to an existing simulator list and at the 
same time It opens a dialog window for defining 
Interface and the window of the truth table for the new 
simulator. If simulators having the same specified name 
already exist, the program denies the action and It 

20 ^ens a dialog window with an alert text to Inform the 
user. By a modify button the user can modify existing 
simulators. Modification function allows the 
modification both of the simulator name and the 
content. The program allows to modify more than one 

25 simulator at the same time. 

For removing a simulator from the simulator list 
It Is possible to use a cancel button which will remove 
the simulator whose name has been highlighted In a 
selection dialog box. 

30 As regards the simulator Interface constituting 
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tlie second step for defining each simula'tor, this is 
coioposed of a form set and of corresponding alias, 
types and functions. To specify the interface a dialog 
window for defining the interface is displayed as 
5 Illustrated in fig. 8. 

The user can specify a form by using a "^modify'' 
command button provided in said dialog window. This 
form is used to identify the variable right name during 
the simulator-variables association. A form can include 

10 parametric or constant conponents in arbitrary order 
and depending on the syntax of the form itself. The 
form definition is an obligated step. Alias is the form 
short name and it is used to identify the form in the 
truth table of the simulator. Alias name has to be 

15 defined in an alias box in the Interface definition 
dialog window and this name specification is necessary. 

The form type substantially describes variable 
rule which are represented by the form in the 
simulation. It is possible to select the used type with 

20 a ^^type'' option box. 

The variables types are: 

Parameter: the parametric type variables represent 
the outside simulator interface. The equations of the 
vital conqputer station apparatus control the simulator 

25 by using these variables, if they are defined as 
^^Inputs''. If variables are defined as ^^outputs" this 
means that they are used as equation input variables of 
the control and command logical program to determine 
and to update the system state. 

30 Control: Such variables are used to control the 
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simulator beliavxour. These variables are associated to 
buttons to offer the user an interface that allows to 
modify the simulator behaviour during the simulation or 
to simulate possible failure situations. Control 
5 variables may have Input or input/output attributes. 
The output attribute is not inhibited but It has no 
meaning In the case of control variables. Variables 
with ^^input'^ attributes are associated to a button that 
Is pressed by clicking with the mouse and released with 

10 another click. If a variable is provided with 
input/output attributes both the simulator and the user 
can set the button state. For example the user clicks 
on a button to activate it and the simulator can 
release it after some action cycle. The form associated 

15 t:o ^^control'' type can include only constant conqponents. 

Local State: ''local'' type variables are used to 
memorize simulator internal states. That is to say that 
this kind of variables allow to define a sequential 
behaviour and not only a combinatorial behaviour. These 

20 variables are not visible from the simulator outside. 
These variables may have only input/output attributes. 
The form associated to the local type variable may 
Include only constant coitponents. 



25 using an ''input/ output" cation box. 

After having specified form alias, the type and 
'^input/output" attribute, the user may add these 
information in the Interface by an ^add" button 
command. Both the specification of the alias and the 

30 specification of the form are obligatory and must be 



Input and output attributes may be selected by 
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unx vocal . 

It ±8 possible to modify the specified attribute 
grmjp such as form, alias, type and '^input/oul^t'^ by a 
selecting action in the dialog window list and by using 
5 a ""modify'^ function button. Analogously it is possible 
to remove a specified attribute. 

The third stop for the simulator definition 
conprises the functional behaviour design. To this end 
the program is provided by a window with a truth table 

10 (s«e right side of fig. 9) . This window is 
automatically opened when the user defines that the 
addition of a new equipment simulator is desired. The 
truth table is divided into two parts separated by a 
thick vertical line. The left part of the truth table 

15 represents the simulator current s totes, while the 
right part is the subsequent stete. The table Includes 
a column for each variable defined In the Interface. 
Variables with ""input"' attributes appear on the left, 
while variables with ""output'' attributes appear on the 

20 right. Variables with ""input/output" attributes appear 
on both sides. The table header includes variable alias 
names . 

This representation allows to design both 
sequential and combinatory logic which functions for 

25 model the simulator behaviour. If a user designs a 
sequential logic (i.e. a logic including ""input /output" 
attribute variables) on the left side appears Markov 
logic model. Circles represent logic stetes, while arcs 
are transitions. Positioning on are arrows, the program 

30 displays the possible input states to stert the 
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transition and the output states set during the 
transition. The window structure is shown in figure 9. 

In the case o£ a new sixoulator, the right side of 
the truth table includes characters representing a 

5 not initialized state. The user can overwrite the 
values in the cells of the right side (ou'^uts) by 
clicking on a cell with the mouse button. Practically 
this means to define that determined output state when 
input conditions appeared (left side of truth table) . 
10 The table of fig. 10 sums up value meanings that can be 
assumed by each single cell of the truth table. 

^^♦'^ value is a cell value not initialized. 

^^X'' value means that if said value is given to a 
cell on the right side of the truth table, in the sane 
15 row even all the boxes of the left side will have ^^X'' 
value. This means that the state identified by the 
corresponding row is not available. Practically this is 
a coxnbination that is not admitted or used during the 
simulation . 

20 "^^0" value means that when input conditions in this 

cycle are verified, next cycle output will go to ^^0'^ 
value. 

Analogously the ^^1'"^ value allows that in the 
subsequent cycle the output will go to said ^^1'^ value. 
25 In order to help the user the window offers 

further functions illustrated in figs. 11 and 12. 

It is possible to enter functions not only by menu 
commands but also by quick buttons, as will be 
described hereinafter. 
30 Modify-Parameters command can be executed also by 
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the quick button indicated at 20 in figure 9« This 
cramand closes the interface definition dialog window. 
When the dialog window is closed i't is possible to open 
it by clicking on said button or by using the coxnmand. 
5 Modify-Copy coxnmand or the quick button indicated 

at 21 in fig. 9 allows to select and to highlight any 
square area of truth table using the mouse as selection 
and activation tool. The selected area can be copied in 
note file. 

10 Modify-Paste command allows to control the content 

of noted in a selected area. The selected area has to 
correspond in size to the area that has been memorised 
in notes. 

Other commands are accessible in this step. For 

15 example the user can modify colours whereon selecting, 
modifying character fonts or task layout fonts. 

The Association function of equipment simulators 
to variables allows to associate the simulators defined 
in the system to a suitable variable group. Such 

20 function is activated by means of Device Configurations- 
Definition command or by means of the quick button 
indicated at 1010 in figs. 5 and 6. To create a link 
between a type of simulator and logic variables 
associated thereto the user has to specify the 

25 station/the area or the equipment to which it is 
applied, the type of simulator and the label of the 
wayside equipment or of the command* to be simulated. To 
help the user it is possible to select these 
information by using option boxes of a dialog window. 

30 Option boxes allow to load the name of the area, of the 
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8tat:xon or of the equipment already defined, the 
defined simulator type and, if there are loaded drawing 
files, the label included in graphic objects of 
drawings. Even if the program prompts the possible 
5 information, the user is free to type any desired 
string. Such possibility allow to specify simulators 
which will be realized later, to make reference to a 
non-loading station and to specify the cAjects to be 
sdLnulated which have not a graphic representation in 

10 drawings . 

The association between variables and simulator 
occurs during the project loading process that is made 
after pressing the close command. If the loading 
process is not capable to carry out the desired 

15 association, the program points out an error and 
displays a message into the loader dialog box. These 
association errors do not prevent the simulation that 
can goes on with valid associations. The identifying 
string may include one or more labels separated by a 

20 ^^"^ character. The identifying string has to correspond 
to forms defined in the interface of the associated 
simulator. The program prevents the multiple definition 
of a descriptor by displaying a proper error message. 

The definition of colours and states of the 

25 drawing objects occurs by means of the Layout 
Configuration conmiand in Configuration menu or by means 
of the quick button indicated at 1110 in figs. 5 and 6. 

The state and colours of a graphic object that 
represent a wayside equipment, an area or a station, 

30 are determined by a variable group defined in the 
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Station/area configuration file. The variable group is 
descrdLbed by using a form for each variable of the 
group. These forms are used to find variables during 
the step of assignment of state and colours to the 
5 drawing'^. As in the equipment simulator definition, it 
is possible to define the state and tbe colour of 
drawing objects in three steps: 

Type of graphic objects included into the drawing; 
Specification of interface, to be done for each 
10 element that has been added or modified during the 
preceding step (type of graphic objects) ; 

State and colour of the drawing objects, to be 
done for each interface of the preceding step. 

Therefore the first step is the specification of 
15 graphic objects types included into the drawing. To 
this end by activating the Configuration -Configuration 
Layout command or by pressing the 1110 button, the 
program displays the dialog window illustrated in fig. 
13. 

20 The user can type the name of new definition of 

graphic object in the ^^Type" modification box of the 
dialog window. The sxabsequent steps for defining the 
interface and for defining colours occurs by adding and 
modifying elements. 

25 When the modification option is activated, by 

means of a correspondent button, two new dialog windows 
are opened shown in figures 14 and 15 respectively and 
which windows allow to modify or add graphic objects. 

The interface specification occurs during the 

30 second step for defining the state and the colour of 
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objects. The Interface la a variable group to determine 
the current colour state of graphic objects. It is 
possible to define the ' variable group by using the 
dialog window illustrated in figure 15. The user can 
5 specify the variable name in the provided box by using 
the same syntax of which it has been already said 
discussed. Analogously to what has been already 
described more times referring to other functions, the 
dialog window has various buttons among which the Add 

10 button. In this case, such button causes a routine to 
add the specified for into the variable form list. The 
program controls the form from a syntax perspective. 
Moreover, the program removes the wrong form and sends 
an error message that is displayed in the message area. 

15 . The program prevents using suffixes which are not 
defined in forms. 

After the interface specification, it is necessary 
to define the state and the colour of the drawing 
objects. The user can specify a state text, an outline 

20 or filling colour for graphic objects of the drawing by 
using the table of fig. 15. 

The window which can be resized to the maximum 
screen size includes variable list (forxos) of the first 
row (header) . The table, as already said, is divided 

25 into two parts separated by a thick vertical line. The 
left side of the table includes state table that can be 
scrolled by the underneath cursor or individually if 
the state table is bigger than the window, whereas the 
right part includes coloured signalling and the 

30 associated text. The user can specify form states by 
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clicking on a cell with the mouse, the program displays 
a summary box for selecting the cell value. Entries o£ 
state summary box are: 

^^0'': this entry set the variable form on false. 



"^X'': this entry removes the whole row containing 
cells that have been activated by the mouse. 

It is possible to add a new row to the definition 
table by clicking with the mouse on a cell of the first 

10 eo^y row in the state table. In this case, the program 
displays the same above state table, but the selected 
''0'' and "^1"^ values are used to initialize the whole 
row. If the row has been initialized is than possible 
to set the desired values for each cell of the row as 

15 described above. 

On the right side of the window are indicated the 
selected colours for the signalling. It will be noted 
that each box is a square with an internal colour and 
an outline or frame colour, both colours being 

20 alterable. For each row that has been filled in the 
table, it is possible to define a colour for outlines, 
a filling colour and a state indication text. After 
having defined a row, the program assigns the 
predetermined colour and state and displays the colours 

25 and state into the two columns on the extreme right of 
the table. The predetermined outline colour is 
intermittent light grey, whereas the filling colour is 
intermittent dark grey and the predetermined state text 
is ''no defined state'^ 

30 It is possible to modify the outline colour by 



5 



this entry set the variable form on true. 
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clicking on the thick edge of the colour definition 
square in a row. In the same way it is possible to 
modify the filling colour by clicking with the mouse on 
the internal square of the colour €iefinition square. To 
5 modify colours a dialog box is displayed. Even the 
flashing attributes may be modified in a analogue way 
as hereindescribed by using the mouse and clicking with 
the right button on the section that is desired to 
become flashing. The flashing is ended by repeating 
10 this action. It is also possible to modify the state 
text by clicking with the mouse on the text to be 
modify in the extreme right column of the table. 

According to a further characteristic of the 
device of the present invention, the device may 
15 comprise means for connecting to a network for the 
connection to workstations or to other remote devices. 
The network can be realized according to various 
protocols. The network protocol that is generally used 
is the TCP/IP protocol due to its great spreading. The 
20 remote unit can be used to control the device and also 
to load and execute pre-existing simulation command 
files that have been previously written. Said command 
files called ^^batch files'' can be also directly loaded 
in the device by means of proper and known reading 
25 interfaces, as for example files that are memorized on 
floppy disks, CD-ROM, or the like. 

However in both the above cases it is necessary 
that batch file commands are translated in a language 
that can be executed by the application of the device 
30 according to the invention. To this end a translate 
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table is provided called conversion table. This one Is 
offline written and must be loaded in the device 
according to tbe invention before executing the batch 
file or before executing the connection and the command 
5 from a remote workstation. 

The condition table selection command allows to 
select a Condition table indicating the path. A dialog 
window is opened as the one illustrated in figure 17. 
The Condition Table file path can be directly written 

10 or a search function can be activated by means of a 
Search'' button provided in the dialog window. When the 
Condition Table file is found, by selecting this file 
it is possible to confirm its loading by means of a 
function button provided in the dialog window. 

15 Advantageously the Condition Table file is' 

structured with a structure similar to that of Windows 
files .INI. Figure 18 illustrates the basis of this 
structure • 

Fig. 19 coiqprises an exaitple of a Condition Table 
20 file. In order to make the information intelligible by 
the Boolean equation system constituting both the 
control and command logical program to be tested and 
the logical simulators of the wayside equipments, of 
stations and/ or of the areas, the condition table 
25 substantially includes the behaviour rules of the 
plant, that are rules for assuming the several 
operating states of wayside equipments in predetermined 
operation condition. 

As already said before, the device allows not only 
30 to check the final behaviour of the control and command 
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logical program on the station or area reproduced by 
Boolean simolators , but also to check the Internal 
behaviour of equation system. This occurs by means of 
control windows that can be defined in relation to the 
5 nuniber by the user himself. The user can assign any 
desired variables to each single control window. The 
program of the device keeps a chronology for each 
variable to allow the user to recall the preceding 
states by using control windows. The tool used to 
10 define control windows is a tool called ^^Views''. Such 
tool allows the opening of a menu that coiqprises 
various options. An option is the Add Control Window 
command. The command is also accessible by a quick 
button indicated at 1210 in figures 5 and 6. This 
15 command allows to open a new control window. For each 
new control window it is required to specify a name 
that must be univocal and for the name definition a new 
dialog window is opened. A typical control window is 
illustrated in the figure and where it is indicated at 
20 30. An open control window has a toolbar that functions 
to set variables to be displayed moving inside the 
chronology. Analogously to ^at already described 
before in other cases, commands are always accessible 
alternatively by a choice in a drop down menu or by 
25 means of quick buttons. 

Add variable command or the quick button 130 allow 
to select variables to be controlled. It is possible to 
pre-select variables to be displayed by using a search 
dialog window. 

30 The search dialog window provides various button 
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that allow to perform functions such as to cancel the 
selection, to add a selected variable, to cancel one or 
more variables and to confirm the selected variables In 
the control window. It Is also provided a butten for 
5 cancel the current selection process. 

By the Cancel Variable command or by the quick 
button 230, It Is possible to remove a displayed 
variable from a control window. Even In this case, as 
In the preceding c<»nmand a dialog window Is displayed 
10 to execute the command and this window has buttons for 
activating specific functions such as Cancel, Cancel 
all , Close . 

The Display Wave /Numerical Form command or quick 
buttons 330, 430 allow the selection of wave or 

15 numerical display modes of variable/variables which are 
displayed In the control window. 

Analogously it is possible to provide commands or 
quick buttons to scroll or browse among the various 
possible control windows that are defined by the user. 

20 The Cancel Control Window command or quick button 

1310 cause the cancellation of a control window. In 
this case a dialog window is displayed wherein all the 
opened control windows are listed and among which it is 
possible to select the control window or windows to be 

25 eliminated, the cancellation being possible by means of 
a ^^Cancel^' button. 

A further cozomand is the simulation command named 
View_J^tivation of command Bar. The command bar can be 
activated and disabled by this command that is 

30 available also as quick button indicated at 1410 in 
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fig. 6. To give comnands the simulator, the program 
displays a control window that Is Illustrated In figure 
20. The control window la coiqposed of a toolbar for 
commands and an area for messages , to display commands 
5 and modifications during the slxmilatlon execution. 
Quick commands In the shape of quick buttons are also 
available, drop down menu commands are also available 
for these commands as already provided for other 
commands • 

10 By the simulation M&de command the user can select 

various options In a drop down menu. Among these 
cations the following are Important: 

Single cycle option, that can be activated also by 
means of quick button 40. This option allows the 

15 execution of a single calculating cycle. After the 
execution the program automatically updates the message 
window and/or window/windows con^rlslng the 
design/layout of the station or the area according to 
the new state. 

20 Continuous cycle option accessible also by the 

quick button 41. In this case, the program starts to 
calculate in a continuous way cycle after cycle. During 
calculation, the message window and/or window/windows 
comprising the design/layout of the station are 

25 automatically updated. 

Multiple cycle option. Even this option can be 
activated by a quick button 42. It is possdLble to 
specify a certain nuxnber of cycles to be calculated 
continually. The specification of the number of cycles 

30 is made by a dialog window wherein it is possible to 
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indicate the desired number of cycles* 

The calculation can be stopped in any moments by a 
stop command or a quick button 43. 

Finally there is also a batch command or a quick 
5 button 44, with which a batch file is loaded and 
executed coxsprising an already made predetermined 
sequence of commands . The batch file execution is 
similar to a macro execution. As already said before, 
batch file commands have to be translate by a 
10 conversion table and must have a predetermined 
structure. Batch files can be edited by means of a 
text-editor such as Write® or Word-padi&. 

The Image file Generation coxamand or the quick 
button 45 allow to memorize the current state of 
15 simulation in a file so-called ""snapshot". Snapshot 
file is saved by the user command with a name suggested 
by the program and including the date and the current 
hour. 

The Reload Image file command or the quick button 
20 46 allow to restore a specific simulation situation by 
calling up a snapshot file previously mexaorized. 
Obviously to select the snapshot file to be call up the 
program displays a dialog window wherein it is possible 
to select the desired snapshot file and open it. 
25 By a restart command or a quick button 47 it is 

possible to restart the simulation. After a restart all 
the equation system variables and the simulator are set 
on value ""0" and the cycle counter is reset. To start 
again the sixmalation it is necessary to execute a reset 
30 sequence of the normal state of wayside equipment 
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sixoulators . 

The User Commands command opens a drop down menu 
that allows to access the Commands Management and 
Variable Value Definition functions. 
5 The commsind management can be call up also with a 

quick button indicated at 48. By this tool it is 
possible to modify simulator behaviour of each type of 
equipment (both physical and logic) by using the button 
associated to the control variables defined during the 
10 sixmalator configuration of equipments. To access the 
proper button the program displays the dialog window 
illustrated in figure 21. The list on the left of the 
dialog window includes the existing types of 
simulators. The user can display the simulators in the 
15 list of the dialog window by clicking with the mouse on 
the selected type. Simulators are identified by the 
first element of identification strings that has been 
specified during the Simula tor- variable association 
described before. It is possible to call up control 
20 buttons by clicking with the mouse on the desired 
simulator and by pressing a control" function key. 

In alternative, by the user command menu it is 
possible to select the Variable Value Definition 
command. Also this command may be activate by a quick 
25 button indicated at 49. This command or this tool allow 
to set manually the variables used in the simulation. 
To select the variable a dialog window is display as 
the one illustrated in fig. 22. 

The dialog window is very similar to the one used 
30 to select variables to be controlled. The selecting 
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procedure Is similar to that of control of 

variables^'. To set the desired or proper value It is 
possible to use two choice options located in the 
bottom corner on the right of the window and selectable 
5 alternately "^True/False". 

The button indicated at 50 allows to activate the 
remote connection procedure to a remote unit. 

According to a further feature and referring to 
figure 4, the state and colours of a graphic object in 

10 the layout of a station or of a zone or of a plant may 
be modified simply by clicking with the mouse on the 
graphic object in the drawing. 

The example that takes cue from figure 4 uses the 
signal 05d circled in black and placed on the left side 

15 of the illustrated layout. The program displays a 
dialog window to set colours and state. 

In this window is provided a ^^label'' field 
containing the internal label of the graphic object 
extracted by the corresponding TGIF or CAD drawing 

20 file. The user cannot modify it. The content of this 
field is used to solve the ^^0'' parametric components of 
forms. An "^"Auxiliary String" modification box allows to 
define the parametric conponents of forms. Each 
parameter must be separated by the character. The 

25 parameter indexing starts with 1, referred to the 
elements conqprised in the auxiliary string. The string 
specification is not obligatory. 

Additionally it is possible to use an ""alias" 
modification box to specify the alias name of the 

30 specified object. The alias name is used to replace the 
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label ext:racted from T6IF or CAD file when tibe program 
lists, in the command window, the objects that are 
changing their state during the simulation. In this 
modification box it is possible to input any character. 
5 The specification of alias names is not obligatory. The 
program prints the original labels in the command 
window when alias are not specified. 

A ^^Type^"" list contains the colour and state tables 
previously defined. The user can select one of these. 
10 If the object has already a defined colour and state 
table, the list automatically highlights the current 



15 confirmation button. The setting of new colours and 
state occurs after the subsequent sixmilating cycle. If 
forms of a specific type cannot be found by using a 
specific label and the auxiliary string, the program 
sends an alert message and ignores the assignment. 

20 Analogously to other functions already described, 

the dialog window comprises or may comprise other 
function buttons with a Cancel button that allows to 
cancel the assignment or Cancel that allows to ignore 
the assignment. 

25 Referring to a further advantageous feature, the 

device according to the invention may comprise also a 
function for executing different automatic test 
backgrounds both on Boolean sixmilator tool and on the 
tool used for the final functional test of the plant. 

30 Obviously, the execution of this function allows the 



^^type" . 

It is also possible to set the assignment for a 
graphic object by clicking with the mouse on a 
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opening of a window tha't allows "to select commands, 
options or to select graplilc or control Ejects, 
analogously to what previously described for other 
functions . 

5 With the starting of graphic Interface constituted 

of said window, lists for selecting areas, type of 
equipments of the station plant are displayed together 
with corresponding data relevant to the station under 
test. The user must select an element Inside each lists 

10 I.e. an area and a type of equipment. Kow, the program 
provides to display values relevant to the equipment 
list of the selected equipment type of the selected 
area and the list of automatic tests which are 
available for the selected equipment type. 

15 The user has the possibility of selecting one or 

more elements from the above lists I.e. selecting one 
or more equipments upon each of them one or more 
automatic tests can be executed. In each lists to each 
selection corresponds the display of the selected 

20 element In correlated lists. The correct selection that 
has been made respectively of an area, equipment type, 
equipment label and of the test label allows to start 
the execution of the test by means of a ^^Launch Test" 
button. The user Is asked to confirm the test execution 

25 In a dialog window. If the response Is affirmative. In 
the text box Identlf Icatlng the slgma ^^executlon test'' 
will be displayed the label of the current test and of 
the equipment that Is object of the test, while In 
another list of the graphic Interface will be displayed 

30 report messages. 
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After starting an automatic test, the button 
'^Launch Tesf label changes in ^Bnd Test'% giving the 
possibility to stop in any moment the automatic test. 
After the stopping of a test, the button label changes 
5 again to ^^Launch Test" state. It is also possible to 
execute individually a single command. 

An exanple of automatic test background is shown 
by the corresponding report file enclosed to Al to A4 
pages. The test is called ^switch points on route (on 
10 routing)''. During the test the covered switch points of 
a route firstly are locked in opposed position with 
respect to the one expected by the route itself. Then 
the test background, by commanding it more times, 
checks that the route does not block until all switch 
15 points are free. It should be noted that the complete 
test execution provides a series of other actions that 
are not subject of the present invention and that are 
not quoted for shortness reasons. 

Referring to figure 1, the device according to the 
20 invention may be used in conjunction with another 
device called Boolean validating or checker. 

In this case it is a hardware/software device, 
i.e. a computer or a personal computer that can be even 
the same coii5>uter of the device according to the 
25 present invention and wherein a program for executing 
the check of the control and command logical program is 
loaded, i.e. a checker of Boolean equations. The check 
program may be of the type operating according to a 
diversity principle. Particularly the Boolean checker 
30 may be composed of a comparator executing a comparison 
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between the command and control logical program, which 
is in the test step in the device according to the 
lAvention, and a further control and command logical 
program which has been generated by generating means 
5 different from that during the test step. It is 
possible to execute the comparison both regarding the 
Boolean equation system of the two control and command 
logical programs and regarding the results of the 
simulating test executed for both the programs. 

10 In case, even the programs simulating operating 

units, i.e. station equipments, areas or stations may 
be subjected to a similar diversity test with the help 
of the Boolean checker. 

According to a preferred type of checker this is 

15 composed of an independent program that is executed on 
a different computer or on the same computer of the 
device according to the invention. This program 
executes in parallel the test of the Boolean equation 
system constituting the control and command logical 

20 program that is s\2bjected to the check. In this case, 
the same logical program for controlling and commanding 
the railway plant is subjected to a dual check test by 
means of railway plant simulation according to what 
described above with two disjoint programs and the 

25 behaviour of the simulated plant obtained under the 
control of the control and command logical program in 
the two disjoint and parallel check tests is compared, 
error or alert files being generated in case of 
differences . 

30 According to a further feature of the invention. 
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for each of the Boolean equation of the equation system 
that compose the logical program for controlling and 
commanding the railway plant. It Is possible to display 
both a list of product terms that are part of the 
displayed equation and the circuit corresponding to 
said displayed equation* Figures 23 and 24 show the 
window for selecting equations and the window for 
displaying a circuit corresponding to one of said 
equation. The selection and the opening of the 
corresponding circuit can be activated by buttons or by 
means of the mouse. 

According to a further feature of the invention, 
the device conprlses a program for designing and 
generating Boolean simulators of equipments or 
operating units that allows to generate new equipments 
with new behaviours. 

Equipments can be conqposed of basic conqponents, 
i.e. conponents for simulating a basic function and of 
conplex components, i.e. a group of basic components 
operating in the sphere of an equipment sdLmulator 
having a more elaborate structure. 

A basic component may be created or selected by a 
list of existing components or crate. The basic 
component generating window is substantially similar to 
the one of figure 9. Obviously in figure 9 it is a 
component already generated or close to the generation. 
Analogously to what already said, a state table is 
generated wherein input variables, output variables, 
control ones and comments are defined. Variable values 
are selectable analogously to those provided for truth 
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table and the provided functions are similar. The 
automaton Illustrated on the left side of figure 9 
(substantially similar to the one for generating the 
equipment sdLmulator) Is the Markov autoxnaton, wherein 
5 states are represented by circles drawn along an 
horizontal line, by using distances calculated 
according to the description of the longer state. The 
description of the state Is Indicated by variables on 
the right of the circle, the state Is composed by the 

10 local variable alias, the variable assuming the ^^false"^ 
condition being Illustrated with a mark on It. On the 
contrary, state transitions are Illustrated by arcs 
going from Initial to final state and the direction of 
the state transition Is Indicated by an arrow upon the 

15 corresponding transition arc. By putting the mouse 
cursor upon the arrow of a transition arc are 
automatically displayed transition conditions as one or 
more Input, control and output variable group. Circle 
and arcs colours are given In a different way depending 

20 on the configuration choices that have been set. 

The Individual basic components defined In such 
way can be cc^nblned or associated therebetween to form 
coxnplex components, being Interfaced therebetween by 
means of the Indication of Interfacing variables or 

25 Input and output Internal variables. 

It Is also possible to display a block diagram of 
the structure of the equipment simulator as appears In 
figure 25. 

It Is clear from what disclosed before and as 
30 results from figure 1 that the 'device according to the 
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lnven1:ion may b© provided also as a device always 
existing in the system for controlling and commanding 
plants as a further non-vital node which can be 
activated both in emergen^ mode to execute periodical 
5 checks o£ the control and command logical program as 
well as backup unit or even as a device to modify and 
upgrade the control and command logical program when 
the system is modified with the removing or the 
addition of stations, areas or wayside equipments. 

10 With regard to the device according to the 

invention it is generally clear that it may be employed 
in any plant having structural analogies with the 
described railway plant and that terms like station 
plant or plant area, aerating unit and wayside 

15 equipment are similar terms. 



